GTK3 applications in a browser with https and basic auth

The theme of my note today is strange. I'll start with the preface. Once, an acquaintance asked a question in our small telegram-chat: “Colleagues, do you know any web terminals? And sometimes you need to log in to your server from work, and here everything is cut to the tonsils, ”well, I asked and asked, everyone said,“ Yes, we don’t know anything at once, ”but I, due to the specifics of thinking, put the question in my head . One night I was reading the GTK3 documentation and came across GDK_BACKEND = broadway . Backend using HTML5 and websockets to display GTK3 applications. Something clicked in the brain, but it clicked strangely that someone seemed to need something, why I don’t remember, and to whom, too.

I lived with these clicks in my head, I remembered who, I even wrote to a person, but I honestly said that during experiments on localhost, my password described in broadwayd mana does not work (password from mana “You can add password file in $ xDG_CONFIG_HOME / broadway.passwd or $ HOME / .config / broadway.passwd with a crypt (3) style password hash. openssl: openssl passwd -1> ~ / .config / broadway. passwd ”), and therefore, on the one hand, it seems like it’s a feature that a person needed, but on the other hand, it’s not so easy to post it, well, to somehow hang the terminal on the Internet is not our choice. I tried to proxy through nginx, so that with https and basic auth (well, or a client certificate, I’m going to want as far as I like), I saw a blank screen and threw it.

I remembered this last night and decided that I had to look at what was the matter, looked again at the broadwayd description and realized that I had a case at websockets, because I tried to proxy just proxy_pass as http.

As a result of carding in turnips, everything turned out for me. Actually, the description, based on the fact that gnome-terminal (and we will run it, along with other gtk you already have).
')
In the nginx config we add a location in which we have basic auth and in which we will be proxying to our broadwayd

location /trm/ { auth_basic "closed site"; auth_basic_user_file /etc/nginx/htpasswd; proxy_redirect off; # websocket proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; # end websocket proxy_read_timeout 86400; proxy_pass http://127.0.0.1:8080/; 

We enable basic auth for the localization station, so that the strangers do not pass (the web server works only on https, so that the good provider and others do not intercept us on the way), we prescribe the headers necessary when proxying web sockets, and change the timeout, because by default proxy_read_timeout in nginx equal to 60 seconds, in the case of web sockets, for us 60 seconds is trouble and grief. Well, we indicate where we will have to wait for us broadwayd

We check the config by executing nginx -t and do nginx'u reload. Under our user, whose terminal we wanted, we do broadwayd -a 127.0.0.1 &. We start broadwayd to listen on lo, by default it runs on port 8080, it has already been set in nginx to proxy to it.
GDK_BACKEND = broadway dbus-launch gnome-terminal. Run the desired gnome-terminal.

We access our web server from a browser, enter the login password from basic auth and see the terminal we are looking for ...

"

PS We have one drawback, the clipboard does not work in applications running on broadway (we are not only a terminal, we can run most applications using GTK3)

PPS I don’t offer such a solution seriously in production, although if the client ssl certificate is used to ensure access security, then why not, the solution will be as safe as ssh key)

I do not exclude that this approach can be used to create something more useful than the gnome-terminal available from the browser.

PPPS Yes. Whatever questions arise about the strangeness of the tasks that I describe in my articles, I will say right away that, due to the nature of my thinking, if I ran, even by chance, before a task that is in my area of ​​competence, then I will solve it, sooner or later, one way or another . Regardless of whether it is necessary for me or someone else is real or not.